run-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands defined in local manifest files under the workflow engine or command.run fields.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local JSON manifests and plans which can influence execution logic.
- Ingestion points: Reads agents/workflows/*.manifest.json and .codex-plan.json to determine workflow steps (SKILL.md).
- Boundary markers: No boundary markers or ignore instructions warnings are applied to the content of the manifest files.
- Capability inventory: Capable of executing shell commands (command.run), spawning agents (spawn_agent), and reading file system metadata (ls, git status).
- Sanitization: The skill lacks sanitization or validation of the instructions contained within the JSON fields before execution.
- [DYNAMIC_EXECUTION]: The skill implements a runtime engine that dynamically executes an execution contract defined in JSON plans, including agent orchestration and task dispatching.
Audit Metadata